Most don't know personal data can be sold

Pizza delivery, rebates among the transactions providing info

Deborah Gage, Chronicle Staff Writer

Published 4:00 am, Thursday, May 15, 2008

Many Californians don't understand how businesses are using and selling their personal information, according to a report released today by the Samuelson Law, Technology and Public Policy Clinic at UC Berkeley.

The survey found that people tend to assume their information is protected from being sold when it's not.

"Businesses are allowed to sell information unless consumers object," said Chris Hoofnagle, the clinic's associate director and a co-author of the report. "There's a (significant) gap between people's understanding of the rules and actual marketplace practices."

With help from the university'sSurvey Research Center, the clinic asked approximately 1,000 people about nine common transactions - ordering a pizza, for instance, or donating to charity - and what they thought happened to their personal information as a result. Responses were weighted to reflect a representative sample of Californians.

In only two categories - subscribing to newspapers or magazines and entering a sweepstakes - did more than 50 percent of respondents understand that when they do these things, they're handing over their information to be sold.

President Trump addresses nation after mass shooting at Florida SchoolWhite House

Otherwise, many got it wrong. A majority of people didn't realize that when they order a pizza, donate to charities, register a product for a warranty, collect a product rebate, give their phone numbers to store clerks or order something from a catalog, they're allowing their information to be sold and shared among companies.

Pizza delivery information also is used by private investigators and governments to track people, the report points out.

A majority of people also don't know that grocery stores in California are prohibited from selling personal information they collect from loyalty club cards.

People who shop online did better on the survey than those who don't. Whether online shoppers are more accustomed to reading privacy policies or are just more suspicious, Hoofnagle said he didn't know.

The survey also divided people into three groups depending on how much they care about privacy - the unconcerned, pragmatists (people who like voluntary privacy standards) and fundamentalists (people who want strong privacy laws). This scheme was developed by Alan Westin, a professor at Columbia University law school.

Fundamentalists - 21 percent of the respondents - did better on the survey than the other two groups. Again, they could be either more knowledgeable about privacy or more suspicious.

One solution to the privacy problem is to require that people opt in, or give explicit permission for organizations to sell or share their information. But businesses have a hard time getting people to do that, Hoofnagle said.

Another idea is to create a national privacy roster modeled on the Federal Trade Commission's Do Not Call list, where people submit phone numbers that businesses and organizations can't call. No such legislation is in the works, however.

The law clinic expects to issue a similar survey on online privacy in the next few weeks.

Fair game

Companies can sell or share your personal information unless they restrict themselves with a privacy policy or are regulated by law. Information can be gathered from: